The recent GhostAction campaign showed that attackers can hijack thousands of GitHub accounts, add credential‑stealing workflows to tens of thousands of repositories, and exfiltrate a wide range of secrets. For AI engineers, platform teams, DevOps and security staff, the incident highlights a concrete failure mode in the CI/CD supply chain that can expose cloud keys, PATs and AI API tokens at scale.
Scope of the GitHub Actions credential theft campaign
GitGuardian tracked the operation from early October, noting an initial burst on October 8‑9 that targeted repositories belonging to about 3,000 users and organizations. The attackers attempted to extract 3,174 secrets, including AWS access keys, GitHub and GitLab personal access tokens, Google/Firebase keys, and API tokens for Anthropic, OpenAI and OpenRouter. Over the course of the campaign, malicious workflows were placed in more than 30,000 repositories after compromising roughly 1,900 accounts.
Earlier phases in August and September had already infected 772 public repositories across 373 users and organizations. Of the 3,669 recorded workflow runs, 499 executed, 336 completed successfully, and 26 secrets were confirmed exfiltrated from 13 repositories. By early October, only 16 % of the affected repositories had been cleaned up.
How the malicious workflows were inserted
The first vector leveraged a shared Action – tj-actions/changed-files – that many projects reference. By poisoning this Action, attackers could affect thousands of downstream repositories without exploiting a vulnerability in GitHub Actions itself. The second vector, dubbed GhostAction, used stolen developer credentials to directly modify .github/workflows/ files. StepSecurity’s analysis points to personal access tokens harvested from credential dumps as the likely source of these stolen credentials.
Once write access was obtained, the attackers added disguised workflow files (e.g., security-audit.yml or github_actions_security.yml) that referenced existing secrets. The jobs ran standard security steps, but also used actions/checkout@v4 with fetch-depth: 0 to clone the full repository history. This allowed the malicious code to scan past commits for keys that had been removed from the current codebase but remained in Git history. Extracted credentials were sent over HTTP to the IP address 193.32.204.199.
Operational gaps exposed by the attack
GitHub’s approval controls blocked many of the injected workflows, yet attackers recycled 92 older malicious workflows that had persisted since September 2025. The incident revealed several practical weaknesses:
- Insufficient monitoring of workflow file changes, especially for accounts with write access.
- Reliance on secret revocation only when a secret is removed from the codebase, ignoring keys that linger in history.
- Limited visibility into PAT activity that could indicate credential theft.
- Low remediation rate – only a fraction of compromised repositories were cleaned up within weeks.
Related CloudNinjas coverage: DevOps.
What This Means For Practitioners
Teams should treat the campaign as a reminder to enforce strict workflow governance and secret hygiene. Immediate steps include:
- Audit recent changes to
.github/workflows/across all repositories and flag modifications made by accounts that do not require write access. - Enable GitHub’s required approvals for workflow changes and consider restricting who can push to the default branch.
- Review PAT usage logs for anomalous activity and revoke any tokens that are no longer needed.
- Rotate all cloud access keys, registry tokens and AI provider API keys that may have been exposed, even if they were removed from the current code.
- Run a history‑wide secret scan (e.g., with
git log -por dedicated scanning tools) to locate and invalidate keys that persist in older commits. - Remove or archive any legacy workflows that are no longer in use, especially those that were part of earlier attacks.
By tightening approval processes, actively monitoring credential usage, and treating Git history as a potential attack surface, engineers can reduce the risk of large‑scale credential theft through compromised CI/CD pipelines.